EMV chip cards and technology basics
What does EMV stand for?
EMV is short for Europay, MasterCard, and Visa, the 1994 founders.
The EMV standard is a secure technology that is used worldwide for all payments done with credit, debit, and prepaid EMV smart cards.
It can be used in three forms: contact, contactless, and mobile.
EMV means robust security for 10 billion payment cards in early 2020 and commonly refers to a credit card with a smart chip.
Let's discover why EMV chip cards are conquering the world in 8 points and a video.
What is an EMV chip?
Chip-and-PIN and Chip-and-signature. What's the difference?
Why is EMV more secure?
A word on the EMV liability shift (a strong motivation)
The latest EMV deployment stats
What are EMV key features?
The very tangible benefits
EMV for mobile payments too
Let's jump right in.
1. What is an EMV smart card?
Today, EMV® defines a suite of security standards for credit and debit card transactions. EMV can be used for NFC mobile payments as well.
EMV chip cards use a smart chip instead of a mag stripe to store the data that is needed to process a transaction.
They are also referred to as "EMV cards", "EMV smartcards" or"EMV credit cards", "chip and PIN cards", "Chip and signature cards" or even "IC cards" (for integrated circuit).
2. What's the difference between chip and PIN and Chip and signature?
In both cases, the cards are EMV cards.
Most cards issued in the United States are chip and signature. The payment process requires the cardholder to provide a signature to complete a transaction, just like credit cards traditionally have in the past.
Outside the United States, chip-and-PIN is more common. The PIN function requires a secret four-digit PIN code known only by the cardholder to validate the payment. It is more secure.
In 2019, most of the ATMs and payment terminals outside the United States have been updated and can detect that your card is EMV compliant, that a PIN wasn’t issued on your card, and validate the transaction.
Anyway, it’s a good idea to travel with a chip card that offers both authentication methods and carry more than one credit card.
3. Why are EMV chip cards more secure?
EMV brings increased security and global interoperability to card and mobile payments, even in card-not-present payments, if coupled with a card reader or one-time password device.
The chip* on an EMV card is capable of much more sophisticated authentication than magnetic-stripe cards.
In other words, there is a fully operating computer system embedded in every EMV card.
The chip is tamper-proof, making the card nearly impossible to clone.
*You can find more information on smart card technology here: smart card basics.
4. What is the EMV liability shift?
In the United States, fraud liability shift (aka EMV liability shift) ran into effect in October 2015 for POS (Point Of Sale) devices.
The liability shift for outdoor Automatic Fuel Dispensers is 1 October 2020.
However, upgrading to EMV is not a law per se.
But the rules defined by Express, Discover, MasterCard and Visa (the EMV mandate) clearly state that the liability for card-present-fraud (typically when you handle your card to the merchant in a store) can now fall on the card-issuing bank or the merchant if the EMV technology is not in place.
That's why Banks are issuing EMV chip cards.
Merchants are also motivated to upgrade their payment devices to accept the new EMV smart cards. If they do not accept the new cards, they could be charged by the Issuing Banks.
That was not the case before.
Needless to say that the EMV migration is now full speed in the U.S.
In August 2015, the Reserve Bank of India (RBI) mandated banks to phase out the magstripe payment cards and migrate to EMV chip cards. RBI set 31 December 2018 as the deadline for the chip and PIN card migration. (Why Indian banks are upgrading your debit, credit cards)
The result?
5. EMV deployment statistics
There are now over 9.9 billion EMV chip cards in circulation at the end of 2019, which is an increase of 20,7% over 2018.
In Q4 2019, according to information collected from American Express, Discover, JCB, Mastercard, UnionPay, and Visa, 80.1% of all chip card-present transactions in the world (both contact and contactless) - used EMV chip technology.
So, is the transition to EMV complete?
No, not yet in Asia and in the U.S.
More precisely for 2018, total EMV transactions were:
96,53% for Africa and the Middle East with 312m cards in circulation
76,81% for Asia with 6,2 billion cards
93,51% for Latin America, Canada, and the Caribbean 923m
97,98% for Europe zone 1 with 1 billion
97,07% for Europe zone 2 with 308m
62,97% for the United States with 1 billion
Globally in 2019, 63.8% of all issued payment cards were EMV chip-based.
Over one year (2018 to 2019), EMV card-present transactions in the U.S. increased from 59,30% to 62.97%, so +6%.
EMV fraud stats
According to a Visa report published in June 2019, U.S. fraud (in value) has been slashed by 87% in March 2019 compared to September 2015.
That means EMV technology is working as planned.
See how EMV chip cards can reduce payment fraud in card-not-present fraud cases as well.
6. EMV technology key security features
The EMV chip
Why do the EMV specs explicitly request a smart chip inside each card?
For one reason - security.
A smart card chip is a small computer with a microprocessor and some memory and application software.
Unlike a magnetic stripe card, a smart card is tough to crack as it's been designed with security in mind.
It also contains a secure vault that holds unique keys specific to each card that protect your transactions.
A Unique Code for Each EMV Payment
EMV cards generate a unique code that is validated by your bank for each transaction, and the code cannot be re-used.
A fraudster couldn't make a transaction using a fake card with stolen data at an EMV terminal because it wouldn't be able to generate the proper code.
In short with EMV technology: No rewind, no replay.
Advanced Cryptography
EMV security relies on strong cryptography, which is used to generate the unique transaction codes that allow the terminal to authenticate the card.
This cryptography is built on private key infrastructure, meaning that only a chip card that is personalised with the cardholder's private key during manufacturing can generate a valid transaction.
SDA vs DDA
Card Authentication Methods (CAMs) were based on Static Data Authentication (SDA).
However, the world has moved on, and the vast majority of payment cards shipped today feature the more sophisticated Dynamic Data Authentication (DDA) or Combined Data Authentication (CDA).
So what is DDA more precisely?
It's a protocol for checking that the EMV chip card is legitimate.
It's an offline authentication method (so without any network). It uses data from the card to allow the terminal to authenticate the card.
The terminal (POS, for example) comes with preloaded with keys. It will check complementary keys on the card for each transaction. It's excellent protection from certificate cloning and card skimming.
Visa and MasterCard have mandated migration to DDA on all EMV smartcards in Europe and Canada, and it is becoming standard in the U.S. too.
7. What are EMV benefits?
EMV chip slashed fraud by half in the U.S. the very first year
EMV is almost 100% effective when it comes to preventing face-to-face (in-store, aka card-present fraud) counterfeit card fraud.
When France migrated to EMV in 2005, card fraud nearly disappeared.
The case replicated in the United Kingdom in 2012 (chip and PIN).
The U.S. began adoption in late 2015 and a study from the (U.S.) Federal Reserve issued in 2018 showed that the amount of card-present fraud in the country declined from $3.68 billion in 2015 to $2.91 billion in 2016.
It's a 48% decrease in ONE year.
Over three years and a half, it's a decrease of 87% according to the June 2019 Visa report mentioned earlier.
Increased card spending
The tap-and-go convenience of a contactless EMV chip card is likely to make it your customers' new favourite, leading to increased loyalty and spending on that card.
Adding contactless capacity has even generated a significant increase in contact transactions made with those cards.
Global interoperability of the EMV standard
EMV is the worldwide standard for payments, the market penetration of the technology is growing around the world, in particular, the nearly 100% EMV compliance in portions of Europe and Canada.
Today, with magnetic-stripe cards, your customers may not be able to pay with their cards when they're travelling internationally.
In other words: Wherever EMV chip cardholders make purchases, they get reliability and convenience.
Strengthened customer relationships
Migrating to EMV is an opportunity to show your customers that you take their security seriously.
8. EMV chip for mobile payments too
Contact EMV chip card
Contact EMV offers the added security of the EMV chip, making it impossible to create counterfeit cards. Contact cards can be used in all EMV capable POS payment terminals.
The card is inserted into the terminal. It stays there while the customer types a PIN or writes his/her signature.
Contactless (dual-interface) EMV card
Contactless is the level to go for if you want a technology that's not only convenient and secure but also future-proof.
The card is tapped against the POS terminal, or simply waved in front of it.
Mobile payment
With mobile EMV, the customer's account credentials are loaded directly onto an NFC-enabled cell phone or wearable device. This process is just as secure as contactless EMV chip, but with superior convenience and added opportunities.
The smartphone is tapped or waved at the POS terminal, just like a contactless card.